CVE-2024-2398 HTTP/2 push headers memory-leak

2024-03-2707:55:48

curl

github.com

cve-2024-2398

http/2

headers

memory-leak

libcurl

error condition

silent failure

application

AI Score

6.8

Confidence

Low

EPSS

0.001

Percentile

17.6%

SSVC

Exploitation

none

Automatable

yes

Technical Impact

partial

JSON

When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. When aborting, libcurl inadvertently does not free all the previously allocated headers and instead leaks the memory. Further, this error condition fails silently and is therefore not easily detected by an application.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:curl:curl:7.4:*:*:*:*:*:*:*"
    ],
    "vendor": "curl",
    "product": "curl",
    "versions": [
      {
        "status": "affected",
        "version": "7.44.0",
        "versionType": "custom",
        "lessThanOrEqual": "8.6.0"
      }
    ],
    "defaultStatus": "unknown"
  }
]